Skip to content

Commit

Permalink
tracing: Have traceprobe_probes_write() not access userspace unnecess…
Browse files Browse the repository at this point in the history
…arily

The code in traceprobe_probes_write() reads up to 4096 bytes from userpace
for each line. If userspace passes in several lines to execute, the code
will do a large read for each line, even though, it is highly likely that
the first read from userspace received all of the lines at once.

I changed the logic to do a single read from userspace, and to only read
from userspace again if not all of the read from userspace made it in.

I tested this by adding printk()s and writing files that would test -1, ==,
and +1 the buffer size, to make sure that there's no overflows and that if a
single line is written with +1 the buffer size, that it fails properly.

Link: http://lkml.kernel.org/r/20170209180458.5c829ab2@gandalf.local.home

Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
Acked-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
  • Loading branch information
Steven Rostedt (VMware) committed Feb 15, 2017
1 parent 4c73841 commit 1f9b354
Showing 1 changed file with 29 additions and 19 deletions.
48 changes: 29 additions & 19 deletions kernel/trace/trace_probe.c
Original file line number Diff line number Diff line change
Expand Up @@ -647,7 +647,7 @@ ssize_t traceprobe_probes_write(struct file *file, const char __user *buffer,
size_t count, loff_t *ppos,
int (*createfn)(int, char **))
{
char *kbuf, *tmp;
char *kbuf, *buf, *tmp;
int ret = 0;
size_t done = 0;
size_t size;
Expand All @@ -667,27 +667,37 @@ ssize_t traceprobe_probes_write(struct file *file, const char __user *buffer,
goto out;
}
kbuf[size] = '\0';
tmp = strchr(kbuf, '\n');
buf = kbuf;
do {
tmp = strchr(buf, '\n');
if (tmp) {
*tmp = '\0';
size = tmp - buf + 1;
} else {
size = strlen(buf);
if (done + size < count) {
if (buf != kbuf)
break;
pr_warn("Line length is too long: Should be less than %d\n",
WRITE_BUFSIZE);
ret = -EINVAL;
goto out;
}
}
done += size;

if (tmp) {
*tmp = '\0';
size = tmp - kbuf + 1;
} else if (done + size < count) {
pr_warn("Line length is too long: Should be less than %d\n",
WRITE_BUFSIZE);
ret = -EINVAL;
goto out;
}
done += size;
/* Remove comments */
tmp = strchr(kbuf, '#');
/* Remove comments */
tmp = strchr(buf, '#');

if (tmp)
*tmp = '\0';
if (tmp)
*tmp = '\0';

ret = traceprobe_command(kbuf, createfn);
if (ret)
goto out;
ret = traceprobe_command(buf, createfn);
if (ret)
goto out;
buf += size;

} while (done < count);
}
ret = done;

Expand Down

0 comments on commit 1f9b354

Please sign in to comment.